|  | 6.7 | Placing ACLs
| 6.7.1 |
Rule: "Putting the extended ACL as close as possible to the source of traffic denied"
As you learned earlier, ACLs are used to control traffic by filtering packets and eliminating unwanted traffic at a destination. Depending on where you place an ACL statement, you can reduce unnecessary traffic. Traffic that will be denied at a remote destination should not use network resources along the route to that destination. Suppose an enterprise's policy aims to deny telnet or FTP traffic on Router A to the switched Ethernet LAN on Router D's E1 port. At the same time, other traffic must be permitted. Several approaches can accomplish this policy. The recommended approach uses an extended ACL. It specifies both source and destination addresses. Place this extended ACL in Router A. Then, packets do not cross Router A's Ethernet, do not cross the serial interfaces of Routers B and C, and do not enter Router D. Traffic with different source and destination addresses can still be permitted. The rule is to put the extended ACLs as close as possible to the source of the traffic denied. Standard ACLs do not specify destination addresses, so you have to put the standard ACL as near the destination as possible. For example, you should place either a standard or an extended ACL on E0 of Router D to prevent traffic from Router A.